TrustBOM: A Scalable Architecture for Confidentiality-Preserving SBOMs Across Organizations
TrustBOM lets vendors prove SBOMs lack specified vulnerabilities or licenses without revealing dependencies.
TrustBOM is a CI/CD architecture for confidentiality-preserving software bills of materials. Providers use zero-knowledge non-membership proofs to attest that specified vulnerabilities or restricted licenses are absent without revealing the dependency graph. Proof generation scales with the number of policy constraints rather than SBOM size, averaging 0.9 seconds per constraint on commodity hardware.
- Zero-knowledge proofs hide dependency graphs while attesting policy compliance.
- Proof cost scales linearly with the number of constraints.
- Average generation time is 0.9 seconds per constraint.
- Designed to integrate with enterprise CI/CD workflows.
Full article148 words · extracted from arxiv.org · click to collapse
Software Bills of Materials (SBOMs) have emerged as a key mechanism for software supply chain governance in enterprise architectures. However, their adoption across organizations remains limited due to concerns about exposing sensitive dependency information. To address this limitation, we propose TrustBOM, a scalable architecture for confidentiality-preserving SBOMs integrated into enterprise CI/CD workflows. TrustBOM enables software providers to attest that specific vulnerabilities or restricted licenses are absent from their software without revealing the underlying dependency graph. This is achieved using zero-knowledge non-membership proofs, which are applied selectively based on consumer-defined policy constraints. The architecture ensures that proof generation scales linearly with the number of asserted constraints rather than with the size of the SBOM, enabling efficient operation in large-scale enterprise environments. Empirical evaluation demonstrates linear performance, with an average proof generation time of 0.9 seconds per constraint on commodity hardware, indicating the feasibility of deployment in enterprise platform ecosystems.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.21419